IP Address: 220.172.224.175Previously Malicious
IP Address: 220.172.224.175Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Scanner |
Services Targeted |
SSH |
Tags |
Access Suspicious Domain SSH New SSH Key Successful SSH Login Download and Execute Outgoing Connection |
Associated Attack Servers |
3.223.51.129 23.43.56.59 39.105.13.218 45.63.66.221 47.52.92.175 47.52.202.185 47.90.87.2 47.95.145.40 47.98.188.113 47.101.146.220 47.101.192.165 47.102.195.168 47.104.161.36 47.105.184.110 47.107.84.175 49.233.195.163 49.235.44.18 50.19.206.143 66.171.248.178 71.57.39.2 103.27.42.59 103.112.104.247 104.238.133.124 106.2.4.58 106.52.52.230 106.52.105.154 106.52.179.77 111.21.180.165 111.229.81.166 111.230.177.120 |
IP Address |
220.172.224.175 |
|
Domain |
- |
|
ISP |
China Telecom |
|
Country |
China |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2020-04-17 |
Last seen in Akamai Guardicore Segmentation |
2020-07-28 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using SSH with the following credentials: root / ******** - Authentication policy: Reached Max Attempts |
Successful SSH Login |
The file /usr/bin/xkgpmg was downloaded and executed 45 times |
Download and Execute |
Process /usr/bin/xkgpmg generated outgoing network traffic to: 1.1.1.1:53, 103.27.42.59:40393, 104.238.133.124:46497, 106.2.4.58:34931, 106.52.179.77:42652, 106.52.52.230:37609, 111.229.81.166:40968, 116.202.55.106:80, 117.73.10.53:42600, 118.25.185.160:33847, 120.24.182.114:36499, 120.25.243.182:16037, 120.25.65.166:58505, 120.26.241.5:45888, 120.55.165.126:54393, 121.42.15.204:46441, 122.51.146.36:46444, 122.51.80.103:41957, 123.194.80.148:46002, 123.57.66.202:39122, 124.234.194.204:42585, 129.211.127.43:35248, 134.209.96.222:37011, 139.9.223.66:39995, 152.136.143.234:35005, 176.58.123.25:80, 192.144.239.253:40651, 193.8.82.77:24231, 202.5.21.4:8000, 204.237.142.122:80, 208.67.222.222:443, 216.239.32.21:80, 216.239.34.21:80, 218.94.106.15:37021, 223.203.98.179:34033, 39.105.13.218:43586, 47.101.146.220:36117, 47.102.195.168:34054, 47.104.161.36:34148, 47.104.161.36:42527, 47.52.202.185:36316, 47.52.202.185:37524, 47.52.92.175:43165, 47.95.145.40:39148, 49.233.195.163:43379, 50.19.206.143:80, 66.171.248.178:80 and 71.57.39.2:36180 |
Outgoing Connection |
Process /usr/bin/xkgpmg attempted to access suspicious domains: hwclouds-dns.com, hybs-pro.net, icanhazip.com, kbronet.com.tw and one.one |
Access Suspicious Domain Outgoing Connection |
The file /usr/bin/chattr was downloaded and executed |
Download and Execute |
Connection was closed due to timeout |
|
An attempt to download /root/.ssh/authorized_keys was made 25 times |
New SSH Key |